External threat actors come from outside the organization and do not have authorized access to the organizations information systems, data, or physical resources and spaces